cohorte 2.10.1 → 3.0.0-dev.1

package/dist/chunks/__host-DgGPyco9.mjs

@@ -0,0 +1,18 @@
+import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
+//#region src/commands/__host/index.ts
+const host = {
+	verb: "__host",
+	async run(ctx, args) {
+		const runIndex = args.positionals.indexOf("--run");
+		const runId = runIndex >= 0 ? args.positionals[runIndex + 1] : void 0;
+		if (!runId || runId.startsWith("--")) return 2;
+		if (!ctx.hostRunner) throw new CohorteError(errorOf("configuration/unexpected", "the detached host composition is missing its run engine binding"));
+		const stop = await ctx.hostRunner.run(runId);
+		ctx.stdio.stdout.write(`${JSON.stringify(stop)}\n`);
+		return stop.reason === "review-clean" ? 0 : 1;
+	}
+};
+//#endregion
+export { host as default };
+
+//# sourceMappingURL=__host-DgGPyco9.mjs.map

package/dist/chunks/__host-DgGPyco9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"__host-DgGPyco9.mjs","names":[],"sources":["../../../../apps/cli/src/commands/__host/index.ts"],"sourcesContent":["// apps/cli/src/commands/__host/index.ts — the hidden detached-host entry point (DESIGN 4.7).\nimport { CohorteError, errorOf } from '@cohorte/base';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst host: CommandModule = {\n  verb: '__host',\n  async run(ctx, args) {\n    const runIndex = args.positionals.indexOf('--run');\n    const runId = runIndex >= 0 ? args.positionals[runIndex + 1] : undefined;\n    if (!runId || runId.startsWith('--')) return 2;\n    if (!ctx.hostRunner) {\n      throw new CohorteError(\n        errorOf('configuration/unexpected', 'the detached host composition is missing its run engine binding'),\n      );\n    }\n    const stop = await ctx.hostRunner.run(runId);\n    ctx.stdio.stdout.write(`${JSON.stringify(stop)}\\n`);\n    return stop.reason === 'review-clean' ? 0 : 1;\n  },\n};\n\nexport default host;\n"],"mappings":";;AAIA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,WAAW,KAAK,YAAY,QAAQ,OAAO;EACjD,MAAM,QAAQ,YAAY,IAAI,KAAK,YAAY,WAAW,KAAK,KAAA;EAC/D,IAAI,CAAC,SAAS,MAAM,WAAW,IAAI,GAAG,OAAO;EAC7C,IAAI,CAAC,IAAI,YACP,MAAM,IAAI,aACR,QAAQ,4BAA4B,iEAAiE,CACvG;EAEF,MAAM,OAAO,MAAM,IAAI,WAAW,IAAI,KAAK;EAC3C,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,IAAI,EAAE,GAAG;EAClD,OAAO,KAAK,WAAW,iBAAiB,IAAI;CAC9C;AACF"}

package/dist/chunks/approve-Cv135UqI.mjs

@@ -0,0 +1,19 @@
+//#region src/commands/approve/index.ts
+const approve = {
+	verb: "approve",
+	async run(ctx, args) {
+		const [runId, approvalId, answer] = args.positionals;
+		if (!runId || !approvalId) return 2;
+		const result = await ctx.controller.send("approve", {
+			approvalId,
+			scope: "once",
+			...answer ? { answer } : {}
+		}, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { approve as default };
+
+//# sourceMappingURL=approve-Cv135UqI.mjs.map

package/dist/chunks/approve-Cv135UqI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-Cv135UqI.mjs","names":[],"sources":["../../../../apps/cli/src/commands/approve/index.ts"],"sourcesContent":["// apps/cli/src/commands/approve/index.ts — DESIGN §9 verb `approve` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/approve/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst approve: CommandModule = {\n  verb: 'approve',\n  async run(ctx, args) {\n    const [runId, approvalId, answer] = args.positionals;\n    if (!runId || !approvalId) return 2;\n    const result = await ctx.controller.send(\n      'approve',\n      { approvalId: approvalId as never, scope: 'once', ...(answer ? { answer } : {}) },\n      { runId },\n    );\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default approve;\n"],"mappings":";AAMA,MAAM,UAAyB;CAC7B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,CAAC,OAAO,YAAY,UAAU,KAAK;EACzC,IAAI,CAAC,SAAS,CAAC,YAAY,OAAO;EAClC,MAAM,SAAS,MAAM,IAAI,WAAW,KAClC,WACA;GAAc;GAAqB,OAAO;GAAQ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAAG,GAChF,EAAE,MAAM,CACV;EACA,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/auth-BT5oVp76.mjs

@@ -0,0 +1,132 @@
+import { t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
+import { c as systemClock } from "./src-Cu3TxNob.mjs";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+//#region ../../packages/base/src/hmac.ts
+/** HMAC-SHA256 as lowercase hex. A string is authenticated as UTF-8. Comparing two MACs is the caller's job, and must be timing-safe. */
+function hmacSha256Hex(key, data) {
+	if (key.byteLength === 0) throw new RangeError("hmacSha256Hex: empty key");
+	return createHmac("sha256", key).update(data).digest("hex");
+}
+/** Domain separation: an anchor body can never be mistaken for a command body signed with the same project key. */
+const ANCHOR_MAC_PURPOSE = "cohorte/chain-anchor/v1";
+/**
+* The MAC anchor of `checkpoint.created` over `(runId, atSequence, chainHash)` (DESIGN 2.6.7, ADR-0022).
+* THE definition: `security` signs with it (`CommandAuthenticator.anchor`) and `persistence` verifies with it
+* (`verifyChain`), and those two packages may not import each other. The signed bytes are the canonical JSON of
+* `{ purpose, runId, atSequence, chainHash }`, so no field can bleed into its neighbour.
+*/
+function computeAnchorMac(key, runId, atSequence, chainHash) {
+	if (!Number.isSafeInteger(atSequence) || atSequence < 0) throw new RangeError(`computeAnchorMac: atSequence must be a non-negative safe integer, got ${atSequence}`);
+	return hmacSha256Hex(key, canonicalJson({
+		purpose: ANCHOR_MAC_PURPOSE,
+		runId,
+		atSequence,
+		chainHash
+	}));
+}
+//#endregion
+//#region ../../packages/security/src/auth/index.ts
+function createKeyStore(options) {
+	const pathFor = (id) => join(options.directory, `${id}.key`);
+	return { async projectKey(projectKeyId, opts) {
+		if (!/^[A-Za-z0-9._-]+$/.test(projectKeyId)) throw new TypeError("invalid project key id");
+		await mkdir(options.directory, {
+			recursive: true,
+			mode: 448
+		});
+		await chmod(options.directory, 448);
+		const path = pathFor(projectKeyId);
+		try {
+			if (((await stat(path)).mode & 511) !== 384) throw new Error("key file permissions are not 0600");
+			const key = await readFile(path);
+			if (key.byteLength !== 32) throw new Error("project key must be 32 bytes");
+			return Uint8Array.from(key);
+		} catch (error) {
+			if (error.code !== "ENOENT" || !opts.create) throw error;
+			const key = randomBytes(32);
+			const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+			await writeFile(temporary, key, { mode: 384 });
+			await chmod(temporary, 384);
+			await rename(temporary, path);
+			return Uint8Array.from(key);
+		}
+	} };
+}
+function createCommandAuthenticator() {
+	return {
+		scheme: "hmac-sha256",
+		sign(canonicalBody, key) {
+			return hmacSha256Hex(key, canonicalBody);
+		},
+		verify(canonicalBody, value, key) {
+			try {
+				const expected = Buffer.from(hmacSha256Hex(key, canonicalBody), "hex");
+				const actual = Buffer.from(value, "hex");
+				return expected.byteLength === actual.byteLength && timingSafeEqual(expected, actual);
+			} catch {
+				return false;
+			}
+		},
+		anchor(runId, atSequence, chainHash, key) {
+			return computeAnchorMac(key, runId, atSequence, chainHash);
+		}
+	};
+}
+function createTrustStore(options) {
+	const pathFor = (id) => join(options.directory, `${id}.json`);
+	const unsigned = (record) => canonicalJson(record);
+	return {
+		async lookup(projectKeyId, policySha256) {
+			try {
+				const path = pathFor(projectKeyId);
+				if (((await stat(path)).mode & 511) !== 384) return void 0;
+				const record = JSON.parse(await readFile(path, "utf8"));
+				if (record.policySha256 !== policySha256) return void 0;
+				const key = await options.keys.projectKey(projectKeyId, { create: false });
+				const { mac: _mac, ...recordWithoutMac } = record;
+				return hmacSha256Hex(key, unsigned(recordWithoutMac)) === record.mac ? record : void 0;
+			} catch {
+				return;
+			}
+		},
+		async grant(projectKeyId, grant) {
+			const key = await options.keys.projectKey(projectKeyId, { create: true });
+			const recordWithoutMac = {
+				policySha256: grant.policySha256,
+				loosenedKeys: [...grant.loosenedKeys],
+				grantedAt: systemClock.now(),
+				grantedBy: grant.grantedBy
+			};
+			const record = {
+				...recordWithoutMac,
+				mac: hmacSha256Hex(key, unsigned(recordWithoutMac))
+			};
+			await mkdir(options.directory, {
+				recursive: true,
+				mode: 448
+			});
+			await chmod(options.directory, 448);
+			const path = pathFor(projectKeyId);
+			const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+			await writeFile(temporary, `${JSON.stringify(record)}\n`, { mode: 384 });
+			await chmod(temporary, 384);
+			await rename(temporary, path);
+			return record;
+		},
+		async revoke(projectKeyId) {
+			try {
+				await unlink(pathFor(projectKeyId));
+				return true;
+			} catch (error) {
+				if (error.code === "ENOENT") return false;
+				throw error;
+			}
+		}
+	};
+}
+//#endregion
+export { computeAnchorMac as i, createKeyStore as n, createTrustStore as r, createCommandAuthenticator as t };
+
+//# sourceMappingURL=auth-BT5oVp76.mjs.map

package/dist/chunks/auth-BT5oVp76.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-BT5oVp76.mjs","names":[],"sources":["../../../../packages/base/src/hmac.ts","../../../../packages/security/src/auth/index.ts"],"sourcesContent":["import { createHmac } from 'node:crypto';\nimport { canonicalJson } from './canonical.ts';\nimport type { RunId } from './ids.ts';\n\n/** HMAC-SHA256 as lowercase hex. A string is authenticated as UTF-8. Comparing two MACs is the caller's job, and must be timing-safe. */\nexport function hmacSha256Hex(key: Uint8Array, data: string | Uint8Array): string {\n  if (key.byteLength === 0) throw new RangeError('hmacSha256Hex: empty key');\n  return createHmac('sha256', key).update(data).digest('hex');\n}\n\n/** Domain separation: an anchor body can never be mistaken for a command body signed with the same project key. */\nexport const ANCHOR_MAC_PURPOSE = 'cohorte/chain-anchor/v1';\n\n/**\n * The MAC anchor of `checkpoint.created` over `(runId, atSequence, chainHash)` (DESIGN 2.6.7, ADR-0022).\n * THE definition: `security` signs with it (`CommandAuthenticator.anchor`) and `persistence` verifies with it\n * (`verifyChain`), and those two packages may not import each other. The signed bytes are the canonical JSON of\n * `{ purpose, runId, atSequence, chainHash }`, so no field can bleed into its neighbour.\n */\nexport function computeAnchorMac(key: Uint8Array, runId: RunId, atSequence: number, chainHash: string): string {\n  if (!Number.isSafeInteger(atSequence) || atSequence < 0) {\n    throw new RangeError(`computeAnchorMac: atSequence must be a non-negative safe integer, got ${atSequence}`);\n  }\n  return hmacSha256Hex(key, canonicalJson({ purpose: ANCHOR_MAC_PURPOSE, runId, atSequence, chainHash }));\n}\n","// File-backed project keys, HMAC command authentication and trust records.\n\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { canonicalJson, computeAnchorMac, hmacSha256Hex, type RunId, systemClock } from '@cohorte/base';\nimport type { TrustRecord, TrustStore } from '@cohorte/config/schema';\nimport type { CommandAuthenticator, KeyStore } from '../contract/index.ts';\n\nexport interface KeyStoreOptions {\n  /** `~/.cohorte/keys`: directory 0700, files 0600; wrong modes are refused */\n  directory: string;\n}\n\nexport function createKeyStore(options: KeyStoreOptions): KeyStore {\n  const pathFor = (id: string): string => join(options.directory, `${id}.key`);\n  return {\n    async projectKey(projectKeyId, opts): Promise<Uint8Array> {\n      if (!/^[A-Za-z0-9._-]+$/.test(projectKeyId)) throw new TypeError('invalid project key id');\n      await mkdir(options.directory, { recursive: true, mode: 0o700 });\n      await chmod(options.directory, 0o700);\n      const path = pathFor(projectKeyId);\n      try {\n        const metadata = await stat(path);\n        if ((metadata.mode & 0o777) !== 0o600) throw new Error('key file permissions are not 0600');\n        const key = await readFile(path);\n        if (key.byteLength !== 32) throw new Error('project key must be 32 bytes');\n        return Uint8Array.from(key);\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== 'ENOENT' || !opts.create) throw error;\n        const key = randomBytes(32);\n        const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n        await writeFile(temporary, key, { mode: 0o600 });\n        await chmod(temporary, 0o600);\n        await rename(temporary, path);\n        return Uint8Array.from(key);\n      }\n    },\n  };\n}\n\nexport function createCommandAuthenticator(): CommandAuthenticator {\n  return {\n    scheme: 'hmac-sha256',\n    sign(canonicalBody, key): string {\n      return hmacSha256Hex(key, canonicalBody);\n    },\n    verify(canonicalBody, value, key): boolean {\n      try {\n        const expected = Buffer.from(hmacSha256Hex(key, canonicalBody), 'hex');\n        const actual = Buffer.from(value, 'hex');\n        return expected.byteLength === actual.byteLength && timingSafeEqual(expected, actual);\n      } catch {\n        return false;\n      }\n    },\n    anchor(runId: RunId, atSequence: number, chainHash: string, key): string {\n      return computeAnchorMac(key, runId, atSequence, chainHash);\n    },\n  };\n}\n\nexport interface TrustStoreOptions {\n  /** `~/.cohorte/trust`: directory 0700, files 0600 */\n  directory: string;\n  /** records are MAC'd with the project key; a bad MAC or wrong modes = ABSENT (fail closed) */\n  keys: KeyStore;\n}\n\nexport function createTrustStore(options: TrustStoreOptions): TrustStore {\n  const pathFor = (id: string): string => join(options.directory, `${id}.json`);\n  const unsigned = (record: Omit<TrustRecord, 'mac'>): string => canonicalJson(record);\n  return {\n    async lookup(projectKeyId, policySha256): Promise<TrustRecord | undefined> {\n      try {\n        const path = pathFor(projectKeyId);\n        const metadata = await stat(path);\n        if ((metadata.mode & 0o777) !== 0o600) return undefined;\n        const record = JSON.parse(await readFile(path, 'utf8')) as TrustRecord;\n        if (record.policySha256 !== policySha256) return undefined;\n        const key = await options.keys.projectKey(projectKeyId, { create: false });\n        const { mac: _mac, ...recordWithoutMac } = record;\n        const expected = hmacSha256Hex(key, unsigned(recordWithoutMac));\n        return expected === record.mac ? record : undefined;\n      } catch {\n        return undefined;\n      }\n    },\n    async grant(projectKeyId, grant): Promise<TrustRecord> {\n      const key = await options.keys.projectKey(projectKeyId, { create: true });\n      const recordWithoutMac = {\n        policySha256: grant.policySha256,\n        loosenedKeys: [...grant.loosenedKeys],\n        grantedAt: systemClock.now(),\n        grantedBy: grant.grantedBy,\n      };\n      const record: TrustRecord = {\n        ...recordWithoutMac,\n        mac: hmacSha256Hex(key, unsigned(recordWithoutMac)),\n      };\n      await mkdir(options.directory, { recursive: true, mode: 0o700 });\n      await chmod(options.directory, 0o700);\n      const path = pathFor(projectKeyId);\n      const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n      await writeFile(temporary, `${JSON.stringify(record)}\\n`, { mode: 0o600 });\n      await chmod(temporary, 0o600);\n      await rename(temporary, path);\n      return record;\n    },\n    async revoke(projectKeyId): Promise<boolean> {\n      try {\n        await unlink(pathFor(projectKeyId));\n        return true;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;\n        throw error;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;AAKA,SAAgB,cAAc,KAAiB,MAAmC;CAChF,IAAI,IAAI,eAAe,GAAG,MAAM,IAAI,WAAW,0BAA0B;CACzE,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AAC5D;;AAGA,MAAa,qBAAqB;;;;;;;AAQlC,SAAgB,iBAAiB,KAAiB,OAAc,YAAoB,WAA2B;CAC7G,IAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,GACpD,MAAM,IAAI,WAAW,yEAAyE,YAAY;CAE5G,OAAO,cAAc,KAAK,cAAc;EAAE,SAAS;EAAoB;EAAO;EAAY;CAAU,CAAC,CAAC;AACxG;;;ACVA,SAAgB,eAAe,SAAoC;CACjE,MAAM,WAAW,OAAuB,KAAK,QAAQ,WAAW,GAAG,GAAG,KAAK;CAC3E,OAAO,EACL,MAAM,WAAW,cAAc,MAA2B;EACxD,IAAI,CAAC,oBAAoB,KAAK,YAAY,GAAG,MAAM,IAAI,UAAU,wBAAwB;EACzF,MAAM,MAAM,QAAQ,WAAW;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC/D,MAAM,MAAM,QAAQ,WAAW,GAAK;EACpC,MAAM,OAAO,QAAQ,YAAY;EACjC,IAAI;GAEF,MAAK,MADkB,KAAK,IAAI,EAAA,CAClB,OAAO,SAAW,KAAO,MAAM,IAAI,MAAM,mCAAmC;GAC1F,MAAM,MAAM,MAAM,SAAS,IAAI;GAC/B,IAAI,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,8BAA8B;GACzE,OAAO,WAAW,KAAK,GAAG;EAC5B,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,YAAY,CAAC,KAAK,QAAQ,MAAM;GAC9E,MAAM,MAAM,YAAY,EAAE;GAC1B,MAAM,YAAY,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI;GACzD,MAAM,UAAU,WAAW,KAAK,EAAE,MAAM,IAAM,CAAC;GAC/C,MAAM,MAAM,WAAW,GAAK;GAC5B,MAAM,OAAO,WAAW,IAAI;GAC5B,OAAO,WAAW,KAAK,GAAG;EAC5B;CACF,EACF;AACF;AAEA,SAAgB,6BAAmD;CACjE,OAAO;EACL,QAAQ;EACR,KAAK,eAAe,KAAa;GAC/B,OAAO,cAAc,KAAK,aAAa;EACzC;EACA,OAAO,eAAe,OAAO,KAAc;GACzC,IAAI;IACF,MAAM,WAAW,OAAO,KAAK,cAAc,KAAK,aAAa,GAAG,KAAK;IACrE,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK;IACvC,OAAO,SAAS,eAAe,OAAO,cAAc,gBAAgB,UAAU,MAAM;GACtF,QAAQ;IACN,OAAO;GACT;EACF;EACA,OAAO,OAAc,YAAoB,WAAmB,KAAa;GACvE,OAAO,iBAAiB,KAAK,OAAO,YAAY,SAAS;EAC3D;CACF;AACF;AASA,SAAgB,iBAAiB,SAAwC;CACvE,MAAM,WAAW,OAAuB,KAAK,QAAQ,WAAW,GAAG,GAAG,MAAM;CAC5E,MAAM,YAAY,WAA6C,cAAc,MAAM;CACnF,OAAO;EACL,MAAM,OAAO,cAAc,cAAgD;GACzE,IAAI;IACF,MAAM,OAAO,QAAQ,YAAY;IAEjC,MAAK,MADkB,KAAK,IAAI,EAAA,CAClB,OAAO,SAAW,KAAO,OAAO,KAAA;IAC9C,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;IACtD,IAAI,OAAO,iBAAiB,cAAc,OAAO,KAAA;IACjD,MAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,cAAc,EAAE,QAAQ,MAAM,CAAC;IACzE,MAAM,EAAE,KAAK,MAAM,GAAG,qBAAqB;IAE3C,OADiB,cAAc,KAAK,SAAS,gBAAgB,CAC/C,MAAM,OAAO,MAAM,SAAS,KAAA;GAC5C,QAAQ;IACN;GACF;EACF;EACA,MAAM,MAAM,cAAc,OAA6B;GACrD,MAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,cAAc,EAAE,QAAQ,KAAK,CAAC;GACxE,MAAM,mBAAmB;IACvB,cAAc,MAAM;IACpB,cAAc,CAAC,GAAG,MAAM,YAAY;IACpC,WAAW,YAAY,IAAI;IAC3B,WAAW,MAAM;GACnB;GACA,MAAM,SAAsB;IAC1B,GAAG;IACH,KAAK,cAAc,KAAK,SAAS,gBAAgB,CAAC;GACpD;GACA,MAAM,MAAM,QAAQ,WAAW;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAC/D,MAAM,MAAM,QAAQ,WAAW,GAAK;GACpC,MAAM,OAAO,QAAQ,YAAY;GACjC,MAAM,YAAY,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI;GACzD,MAAM,UAAU,WAAW,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,EAAE,MAAM,IAAM,CAAC;GACzE,MAAM,MAAM,WAAW,GAAK;GAC5B,MAAM,OAAO,WAAW,IAAI;GAC5B,OAAO;EACT;EACA,MAAM,OAAO,cAAgC;GAC3C,IAAI;IACF,MAAM,OAAO,QAAQ,YAAY,CAAC;IAClC,OAAO;GACT,SAAS,OAAO;IACd,IAAK,MAAgC,SAAS,UAAU,OAAO;IAC/D,MAAM;GACR;EACF;CACF;AACF"}

package/dist/chunks/auth-CYOh60KG.mjs

@@ -0,0 +1,93 @@
+import { createInterface } from "node:readline/promises";
+//#region src/commands/auth/index.ts
+function document(ctx, statuses) {
+	return {
+		documentVersion: 1,
+		generatedAt: ctx.clock.now(),
+		runtime: (() => {
+			return {
+				id: ctx.runtime.resolve().id,
+				version: "unknown"
+			};
+		})(),
+		providers: statuses.map((status) => ({
+			...status,
+			...status.accountLabel === void 0 ? { accountLabelNote: "account: not exposed by the engine" } : {}
+		}))
+	};
+}
+function print(ctx, value) {
+	if (ctx.stdio.stdout && value) ctx.stdio.stdout.write(`${JSON.stringify(value)}\n`);
+}
+async function loginUi(ctx, signal) {
+	const readline = createInterface({
+		input: ctx.stdio.stdin,
+		output: ctx.stdio.stdout,
+		terminal: false
+	});
+	const abort = () => readline.close();
+	signal.addEventListener("abort", abort, { once: true });
+	return {
+		show(event) {
+			const text = event.message ?? event.instructions ?? event.url ?? event.verificationUri ?? event.userCode ?? "";
+			if (text) ctx.stdio.stdout.write(`${text}\n`);
+		},
+		async ask(prompt) {
+			if (prompt.kind === "select" && prompt.options?.length) {
+				ctx.stdio.stdout.write(`${prompt.message}\n`);
+				prompt.options.forEach((option, index) => {
+					ctx.stdio.stdout.write(`  ${index + 1}. ${option.label}\n`);
+				});
+				const answer = await readline.question("Choice: ");
+				const index = Number.parseInt(answer, 10) - 1;
+				return prompt.options[index]?.id ?? answer;
+			}
+			return readline.question(`${prompt.message} `);
+		},
+		close() {
+			signal.removeEventListener("abort", abort);
+			readline.close();
+		}
+	};
+}
+const auth = {
+	verb: "auth",
+	async run(ctx, args) {
+		const runtime = ctx.runtime.resolve();
+		const provider = args.positionals[0];
+		if (args.subVerb === "status" || args.subVerb === void 0) {
+			const value = document(ctx, await runtime.authStatus(provider ? [provider] : ["openai-codex", "anthropic"]));
+			if (args.json) print(ctx, value);
+			else for (const status of value.providers) ctx.stdio.stdout.write(`${status.provider}: ${status.state} (${status.billing})\n`);
+			return 0;
+		}
+		if (!provider) return 2;
+		if (args.subVerb === "logout") {
+			await runtime.logout(provider);
+			const value = document(ctx, await runtime.authStatus([provider]));
+			if (args.json) print(ctx, value);
+			else ctx.stdio.stdout.write(`${provider}: logged out\n`);
+			return 0;
+		}
+		if (args.subVerb === "login") {
+			const controller = new AbortController();
+			const timeout = setTimeout(() => controller.abort(), 6e5);
+			const ui = await loginUi(ctx, controller.signal);
+			try {
+				const status = await runtime.login(provider, ui, controller.signal);
+				const value = document(ctx, [status]);
+				if (args.json) print(ctx, value);
+				else ctx.stdio.stdout.write(`${status.provider}: ${status.state}\n`);
+				return 0;
+			} finally {
+				clearTimeout(timeout);
+				ui.close();
+			}
+		}
+		return 10;
+	}
+};
+//#endregion
+export { auth as default };
+
+//# sourceMappingURL=auth-CYOh60KG.mjs.map

package/dist/chunks/auth-CYOh60KG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-CYOh60KG.mjs","names":[],"sources":["../../../../apps/cli/src/commands/auth/index.ts"],"sourcesContent":["// apps/cli/src/commands/auth/index.ts — DESIGN §9 verb `auth`; provider authentication is delegated to the\n// selected runtime child so credentials never cross the CLI/runtime boundary.\nimport { createInterface } from 'node:readline/promises';\nimport type { ProviderAuthStatus } from '@cohorte/runtime-contract';\nimport type { CommandModule } from '../../contract/index.ts';\n\nfunction document(ctx: Parameters<CommandModule['run']>[0], statuses: ProviderAuthStatus[]) {\n  return {\n    documentVersion: 1,\n    generatedAt: ctx.clock.now(),\n    runtime: (() => {\n      const runtime = ctx.runtime.resolve();\n      return { id: runtime.id, version: 'unknown' };\n    })(),\n    providers: statuses.map((status) => ({\n      ...status,\n      ...(status.accountLabel === undefined ? { accountLabelNote: 'account: not exposed by the engine' } : {}),\n    })),\n  };\n}\n\nfunction print(ctx: Parameters<CommandModule['run']>[0], value: ReturnType<typeof document>): void {\n  if (ctx.stdio.stdout && value) ctx.stdio.stdout.write(`${JSON.stringify(value)}\\n`);\n}\n\nasync function loginUi(ctx: Parameters<CommandModule['run']>[0], signal: AbortSignal) {\n  const readline = createInterface({ input: ctx.stdio.stdin, output: ctx.stdio.stdout, terminal: false });\n  const abort = () => readline.close();\n  signal.addEventListener('abort', abort, { once: true });\n  return {\n    show(event: {\n      kind: string;\n      url?: string;\n      instructions?: string;\n      message?: string;\n      userCode?: string;\n      verificationUri?: string;\n    }) {\n      const text = event.message ?? event.instructions ?? event.url ?? event.verificationUri ?? event.userCode ?? '';\n      if (text) ctx.stdio.stdout.write(`${text}\\n`);\n    },\n    async ask(prompt: { kind: string; message: string; options?: { id: string; label: string }[] }) {\n      if (prompt.kind === 'select' && prompt.options?.length) {\n        ctx.stdio.stdout.write(`${prompt.message}\\n`);\n        prompt.options.forEach((option, index) => {\n          ctx.stdio.stdout.write(`  ${index + 1}. ${option.label}\\n`);\n        });\n        const answer = await readline.question('Choice: ');\n        const index = Number.parseInt(answer, 10) - 1;\n        return prompt.options[index]?.id ?? answer;\n      }\n      return readline.question(`${prompt.message} `);\n    },\n    close() {\n      signal.removeEventListener('abort', abort);\n      readline.close();\n    },\n  };\n}\n\nconst auth: CommandModule = {\n  verb: 'auth',\n  async run(ctx, args) {\n    const runtime = ctx.runtime.resolve();\n    const provider = args.positionals[0];\n    if (args.subVerb === 'status' || args.subVerb === undefined) {\n      const statuses = await runtime.authStatus(provider ? [provider] : ['openai-codex', 'anthropic']);\n      const value = document(ctx, statuses);\n      if (args.json) print(ctx, value);\n      else\n        for (const status of value.providers)\n          ctx.stdio.stdout.write(`${status.provider}: ${status.state} (${status.billing})\\n`);\n      return 0;\n    }\n    if (!provider) return 2;\n    if (args.subVerb === 'logout') {\n      await runtime.logout(provider);\n      const value = document(ctx, await runtime.authStatus([provider]));\n      if (args.json) print(ctx, value);\n      else ctx.stdio.stdout.write(`${provider}: logged out\\n`);\n      return 0;\n    }\n    if (args.subVerb === 'login') {\n      const controller = new AbortController();\n      const timeout = setTimeout(() => controller.abort(), 10 * 60_000);\n      const ui = await loginUi(ctx, controller.signal);\n      try {\n        const status = await runtime.login(provider, ui, controller.signal);\n        const value = document(ctx, [status]);\n        if (args.json) print(ctx, value);\n        else ctx.stdio.stdout.write(`${status.provider}: ${status.state}\\n`);\n        return 0;\n      } finally {\n        clearTimeout(timeout);\n        ui.close();\n      }\n    }\n    return 10;\n  },\n};\n\nexport default auth;\n"],"mappings":";;AAMA,SAAS,SAAS,KAA0C,UAAgC;CAC1F,OAAO;EACL,iBAAiB;EACjB,aAAa,IAAI,MAAM,IAAI;EAC3B,gBAAgB;GAEd,OAAO;IAAE,IADO,IAAI,QAAQ,QACT,CAAC,CAAC;IAAI,SAAS;GAAU;EAC9C,EAAA,CAAG;EACH,WAAW,SAAS,KAAK,YAAY;GACnC,GAAG;GACH,GAAI,OAAO,iBAAiB,KAAA,IAAY,EAAE,kBAAkB,qCAAqC,IAAI,CAAC;EACxG,EAAE;CACJ;AACF;AAEA,SAAS,MAAM,KAA0C,OAA0C;CACjG,IAAI,IAAI,MAAM,UAAU,OAAO,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;AACpF;AAEA,eAAe,QAAQ,KAA0C,QAAqB;CACpF,MAAM,WAAW,gBAAgB;EAAE,OAAO,IAAI,MAAM;EAAO,QAAQ,IAAI,MAAM;EAAQ,UAAU;CAAM,CAAC;CACtG,MAAM,cAAc,SAAS,MAAM;CACnC,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,OAAO;EACL,KAAK,OAOF;GACD,MAAM,OAAO,MAAM,WAAW,MAAM,gBAAgB,MAAM,OAAO,MAAM,mBAAmB,MAAM,YAAY;GAC5G,IAAI,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,GAAG;EAC9C;EACA,MAAM,IAAI,QAAsF;GAC9F,IAAI,OAAO,SAAS,YAAY,OAAO,SAAS,QAAQ;IACtD,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,QAAQ,GAAG;IAC5C,OAAO,QAAQ,SAAS,QAAQ,UAAU;KACxC,IAAI,MAAM,OAAO,MAAM,KAAK,QAAQ,EAAE,IAAI,OAAO,MAAM,GAAG;IAC5D,CAAC;IACD,MAAM,SAAS,MAAM,SAAS,SAAS,UAAU;IACjD,MAAM,QAAQ,OAAO,SAAS,QAAQ,EAAE,IAAI;IAC5C,OAAO,OAAO,QAAQ,MAAM,EAAE,MAAM;GACtC;GACA,OAAO,SAAS,SAAS,GAAG,OAAO,QAAQ,EAAE;EAC/C;EACA,QAAQ;GACN,OAAO,oBAAoB,SAAS,KAAK;GACzC,SAAS,MAAM;EACjB;CACF;AACF;AAEA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,UAAU,IAAI,QAAQ,QAAQ;EACpC,MAAM,WAAW,KAAK,YAAY;EAClC,IAAI,KAAK,YAAY,YAAY,KAAK,YAAY,KAAA,GAAW;GAE3D,MAAM,QAAQ,SAAS,KAAK,MADL,QAAQ,WAAW,WAAW,CAAC,QAAQ,IAAI,CAAC,gBAAgB,WAAW,CAAC,CAC3D;GACpC,IAAI,KAAK,MAAM,MAAM,KAAK,KAAK;QAE7B,KAAK,MAAM,UAAU,MAAM,WACzB,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,SAAS,IAAI,OAAO,MAAM,IAAI,OAAO,QAAQ,IAAI;GACtF,OAAO;EACT;EACA,IAAI,CAAC,UAAU,OAAO;EACtB,IAAI,KAAK,YAAY,UAAU;GAC7B,MAAM,QAAQ,OAAO,QAAQ;GAC7B,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,WAAW,CAAC,QAAQ,CAAC,CAAC;GAChE,IAAI,KAAK,MAAM,MAAM,KAAK,KAAK;QAC1B,IAAI,MAAM,OAAO,MAAM,GAAG,SAAS,eAAe;GACvD,OAAO;EACT;EACA,IAAI,KAAK,YAAY,SAAS;GAC5B,MAAM,aAAa,IAAI,gBAAgB;GACvC,MAAM,UAAU,iBAAiB,WAAW,MAAM,GAAG,GAAW;GAChE,MAAM,KAAK,MAAM,QAAQ,KAAK,WAAW,MAAM;GAC/C,IAAI;IACF,MAAM,SAAS,MAAM,QAAQ,MAAM,UAAU,IAAI,WAAW,MAAM;IAClE,MAAM,QAAQ,SAAS,KAAK,CAAC,MAAM,CAAC;IACpC,IAAI,KAAK,MAAM,MAAM,KAAK,KAAK;SAC1B,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,SAAS,IAAI,OAAO,MAAM,GAAG;IACnE,OAAO;GACT,UAAU;IACR,aAAa,OAAO;IACpB,GAAG,MAAM;GACX;EACF;EACA,OAAO;CACT;AACF"}

package/dist/chunks/brainstorm-BwKA6yZP.mjs

@@ -0,0 +1,7 @@
+import { r as notImplementedCommand } from "./contract-BkMjU1kR.mjs";
+//#region src/commands/brainstorm/index.ts
+var brainstorm_default = notImplementedCommand("brainstorm");
+//#endregion
+export { brainstorm_default as default };
+
+//# sourceMappingURL=brainstorm-BwKA6yZP.mjs.map

package/dist/chunks/brainstorm-BwKA6yZP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"brainstorm-BwKA6yZP.mjs","names":[],"sources":["../../../../apps/cli/src/commands/brainstorm/index.ts"],"sourcesContent":["// apps/cli/src/commands/brainstorm/index.ts — DESIGN §9 verb `brainstorm` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/brainstorm/**`.\nimport { notImplementedCommand } from '../../contract/index.ts';\n\nexport default notImplementedCommand('brainstorm');\n"],"mappings":";;AAMA,IAAA,qBAAe,sBAAsB,YAAY"}

package/dist/chunks/cancel-KV_cpsqS.mjs

@@ -0,0 +1,15 @@
+//#region src/commands/cancel/index.ts
+const cancel = {
+	verb: "cancel",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const result = await ctx.controller.send("cancel", { keepWorktrees: false }, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { cancel as default };
+
+//# sourceMappingURL=cancel-KV_cpsqS.mjs.map

package/dist/chunks/cancel-KV_cpsqS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel-KV_cpsqS.mjs","names":[],"sources":["../../../../apps/cli/src/commands/cancel/index.ts"],"sourcesContent":["// apps/cli/src/commands/cancel/index.ts — DESIGN §9 verb `cancel` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/cancel/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst cancel: CommandModule = {\n  verb: 'cancel',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const result = await ctx.controller.send('cancel', { keepWorktrees: false }, { runId });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default cancel;\n"],"mappings":";AAMA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,UAAU,EAAE,eAAe,MAAM,GAAG,EAAE,MAAM,CAAC;EACtF,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/canonical-C8UxeEmB.mjs

@@ -0,0 +1,57 @@
+import { createHash } from "node:crypto";
+//#region ../../packages/base/src/canonical.ts
+const describe = (value) => {
+	if (value === null) return "null";
+	if (typeof value !== "object") return typeof value;
+	const name = Object.getPrototypeOf(value)?.constructor?.name;
+	return typeof name === "string" && name ? name : "object";
+};
+const write = (value, path, ancestors) => {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "boolean": return value ? "true" : "false";
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`canonicalJson: ${value} at ${path || "/"} is not a JSON number`);
+			return JSON.stringify(value);
+		case "string": return JSON.stringify(value.normalize("NFC"));
+		case "object": break;
+		default: throw new TypeError(`canonicalJson: a ${typeof value} at ${path || "/"} is not JSON`);
+	}
+	if (ancestors.has(value)) throw new TypeError(`canonicalJson: cycle at ${path || "/"}`);
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) {
+			const items = [];
+			for (let index = 0; index < value.length; index += 1) items.push(write(value[index], `${path}/${index}`, ancestors));
+			return `[${items.join(",")}]`;
+		}
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) throw new TypeError(`canonicalJson: a ${describe(value)} at ${path || "/"} is not a plain JSON object`);
+		const members = /* @__PURE__ */ new Map();
+		for (const [rawKey, member] of Object.entries(value)) {
+			if (member === void 0) continue;
+			const key = rawKey.normalize("NFC");
+			if (members.has(key)) throw new TypeError(`canonicalJson: two keys collide as ${JSON.stringify(key)} at ${path || "/"} once normalised`);
+			members.set(key, write(member, `${path}/${key}`, ancestors));
+		}
+		return `{${[...members.keys()].sort().map((key) => `${JSON.stringify(key)}:${members.get(key)}`).join(",")}}`;
+	} finally {
+		ancestors.delete(value);
+	}
+};
+/**
+* The one serialisation that is hashed, signed or compared: sorted keys, no whitespace, NFC strings (keys included).
+* Throws a TypeError on anything that is not JSON — a non-finite number, `undefined` outside an object member,
+* a function, a bigint, a class instance, a cycle — rather than hash something `JSON.parse` could not give back.
+*/
+function canonicalJson(v) {
+	return write(v, "", /* @__PURE__ */ new Set());
+}
+/** A string is hashed as UTF-8, as given: no normalisation here. */
+function sha256Hex(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+//#endregion
+export { sha256Hex as n, canonicalJson as t };
+
+//# sourceMappingURL=canonical-C8UxeEmB.mjs.map

package/dist/chunks/canonical-C8UxeEmB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-C8UxeEmB.mjs","names":[],"sources":["../../../../packages/base/src/canonical.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport type { Sha256 } from './ids.ts';\nimport type { JsonValue } from './json.ts';\n\nconst describe = (value: unknown): string => {\n  if (value === null) return 'null';\n  if (typeof value !== 'object') return typeof value;\n  const name: unknown = Object.getPrototypeOf(value)?.constructor?.name;\n  return typeof name === 'string' && name ? name : 'object';\n};\n\nconst write = (value: unknown, path: string, ancestors: Set<object>): string => {\n  if (value === null) return 'null';\n  switch (typeof value) {\n    case 'boolean':\n      return value ? 'true' : 'false';\n    case 'number':\n      if (!Number.isFinite(value))\n        throw new TypeError(`canonicalJson: ${value} at ${path || '/'} is not a JSON number`);\n      // JSON.stringify is the ECMAScript shortest round-trip form RFC 8785 prescribes, and writes -0 as 0.\n      return JSON.stringify(value);\n    case 'string':\n      return JSON.stringify(value.normalize('NFC'));\n    case 'object':\n      break;\n    default:\n      throw new TypeError(`canonicalJson: a ${typeof value} at ${path || '/'} is not JSON`);\n  }\n\n  if (ancestors.has(value)) throw new TypeError(`canonicalJson: cycle at ${path || '/'}`);\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value)) {\n      const items: string[] = [];\n      for (let index = 0; index < value.length; index += 1)\n        items.push(write(value[index], `${path}/${index}`, ancestors));\n      return `[${items.join(',')}]`;\n    }\n    const proto: unknown = Object.getPrototypeOf(value);\n    if (proto !== Object.prototype && proto !== null) {\n      throw new TypeError(`canonicalJson: a ${describe(value)} at ${path || '/'} is not a plain JSON object`);\n    }\n    const members = new Map<string, string>();\n    for (const [rawKey, member] of Object.entries(value)) {\n      // Dropped exactly as JSON.stringify drops it, so a value hashes like the form that gets stored.\n      if (member === undefined) continue;\n      const key = rawKey.normalize('NFC');\n      if (members.has(key))\n        throw new TypeError(\n          `canonicalJson: two keys collide as ${JSON.stringify(key)} at ${path || '/'} once normalised`,\n        );\n      members.set(key, write(member, `${path}/${key}`, ancestors));\n    }\n    // Default sort = UTF-16 code units, the order of RFC 8785.\n    const keys = [...members.keys()].sort();\n    return `{${keys.map((key) => `${JSON.stringify(key)}:${members.get(key)}`).join(',')}}`;\n  } finally {\n    ancestors.delete(value);\n  }\n};\n\n/**\n * The one serialisation that is hashed, signed or compared: sorted keys, no whitespace, NFC strings (keys included).\n * Throws a TypeError on anything that is not JSON — a non-finite number, `undefined` outside an object member,\n * a function, a bigint, a class instance, a cycle — rather than hash something `JSON.parse` could not give back.\n */\nexport function canonicalJson(v: JsonValue): string {\n  return write(v, '', new Set());\n}\n\n/** A string is hashed as UTF-8, as given: no normalisation here. */\nexport function sha256Hex(data: string | Uint8Array): Sha256 {\n  return createHash('sha256').update(data).digest('hex') as Sha256;\n}\n"],"mappings":";;AAIA,MAAM,YAAY,UAA2B;CAC3C,IAAI,UAAU,MAAM,OAAO;CAC3B,IAAI,OAAO,UAAU,UAAU,OAAO,OAAO;CAC7C,MAAM,OAAgB,OAAO,eAAe,KAAK,CAAC,EAAE,aAAa;CACjE,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO;AACnD;AAEA,MAAM,SAAS,OAAgB,MAAc,cAAmC;CAC9E,IAAI,UAAU,MAAM,OAAO;CAC3B,QAAQ,OAAO,OAAf;EACE,KAAK,WACH,OAAO,QAAQ,SAAS;EAC1B,KAAK;GACH,IAAI,CAAC,OAAO,SAAS,KAAK,GACxB,MAAM,IAAI,UAAU,kBAAkB,MAAM,MAAM,QAAQ,IAAI,sBAAsB;GAEtF,OAAO,KAAK,UAAU,KAAK;EAC7B,KAAK,UACH,OAAO,KAAK,UAAU,MAAM,UAAU,KAAK,CAAC;EAC9C,KAAK,UACH;EACF,SACE,MAAM,IAAI,UAAU,oBAAoB,OAAO,MAAM,MAAM,QAAQ,IAAI,aAAa;CACxF;CAEA,IAAI,UAAU,IAAI,KAAK,GAAG,MAAM,IAAI,UAAU,2BAA2B,QAAQ,KAAK;CACtF,UAAU,IAAI,KAAK;CACnB,IAAI;EACF,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,QAAkB,CAAC;GACzB,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GACjD,MAAM,KAAK,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,SAAS,SAAS,CAAC;GAC/D,OAAO,IAAI,MAAM,KAAK,GAAG,EAAE;EAC7B;EACA,MAAM,QAAiB,OAAO,eAAe,KAAK;EAClD,IAAI,UAAU,OAAO,aAAa,UAAU,MAC1C,MAAM,IAAI,UAAU,oBAAoB,SAAS,KAAK,EAAE,MAAM,QAAQ,IAAI,4BAA4B;EAExG,MAAM,0BAAU,IAAI,IAAoB;EACxC,KAAK,MAAM,CAAC,QAAQ,WAAW,OAAO,QAAQ,KAAK,GAAG;GAEpD,IAAI,WAAW,KAAA,GAAW;GAC1B,MAAM,MAAM,OAAO,UAAU,KAAK;GAClC,IAAI,QAAQ,IAAI,GAAG,GACjB,MAAM,IAAI,UACR,sCAAsC,KAAK,UAAU,GAAG,EAAE,MAAM,QAAQ,IAAI,iBAC9E;GACF,QAAQ,IAAI,KAAK,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,SAAS,CAAC;EAC7D;EAGA,OAAO,IADM,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,KACnB,CAAC,CAAC,KAAK,QAAQ,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;CACvF,UAAU;EACR,UAAU,OAAO,KAAK;CACxB;AACF;;;;;;AAOA,SAAgB,cAAc,GAAsB;CAClD,OAAO,MAAM,GAAG,oBAAI,IAAI,IAAI,CAAC;AAC/B;;AAGA,SAAgB,UAAU,MAAmC;CAC3D,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AACvD"}